AI 资讯
Keeping Mac work alive without pretending awake means safe
A developer usually meets Mac power management through a simple need. A build, local server, download, or agent is still running, and idle sleep would interrupt it. The caffeinate command can be enough for that open lid case. Lid close is a different boundary. An idle sleep assertion does not mean the same thing as a closed display session, and a product should not blur the distinction. I built Afterlid around three explicit states. Sleepy follows normal sleep. Awake prevents idle system and display sleep while the lid is open. Always On is the lid closed mode, with the display off. The important engineering work begins after activation. What happens if the app crashes? What happens when the battery is falling or the machine is under thermal pressure? What state is restored after a helper failure? For Afterlid, Always On ends at 30 percent battery while unplugged, under serious or critical thermal pressure, when the app heartbeat disappears, or after eight hours. When a limit fires, the app drops its wake assertion and returns the Mac to normal sleep behaviour. The current implementation uses a small privileged helper and an undocumented macOS sleep setting for the lid closed path. That makes broad hardware testing and honest release notes essential. It is not something I want to hide behind a friendly menu bar character. A useful principle emerged from the work: activation is a feature, but recovery is the product. If you are building a system utility, test the path back to the operating system defaults with the same seriousness as the path into your special mode. Founder disclosure: I built Afterlid. The full product and current boundaries are here: AfterLid
AI 资讯
Knowing When to Use If/Else vs. Switch in JavaScript
If/else statements - We all know and love them. While they are incredibly powerful, there comes a point where a long chain of conditions only makes your code look messy. Choosing between if/else and switch depends on readability, but there's a hidden pro tip that makes switch much more powerful than many people think at first. Traditional Approach: If/Else Normally, we use if/else when our logic depends on complex ranges and multiple variables: // Hard to scan, bulky, and prone to typos let weatherAdvice = "" ; if ( temperature < 15 && isRaining ) { weatherAdvice = " Grab a heavy coat and an umbrella! 🌧️🧥 " ; } else if ( temperature < 15 && ! isRaining ) { weatherAdvice = " It's cold but dry. Just a jacket is fine! 🧥 " ; } else if ( temperature >= 15 && isRaining && isNightTime ) { weatherAdvice = " Warm, rainy night. Stay indoors if you can! 🌧️🌃 " ; } else if ( temperature >= 15 && isRaining && ! isNightTime ) { weatherAdvice = " Warm rain during the day. Don't forget your umbrella! 🌧️🌦️ " ; } else if ( temperature >= 30 && ! isRaining ) { weatherAdvice = " It's scorching hot! Stay hydrated! ☀️🥤 " ; } else { weatherAdvice = " Weather seems pleasant today! 😎 " ; } Pro Tip: Using switch(true) Many developers think you can only use switch when you're checking a single variable against fixed values. However, you can use a switch statement for complex ranges by passing the boolean value true into the switch condition. Here is a cleaner switch statement version of the above code block: // Much easier on the eyes let weatherAdvice = "" ; switch ( true ) { case ( temperature < 15 && isRaining ): weatherAdvice = " Grab a heavy coat and an umbrella! 🌧️🧥 " ; break ; case ( temperature < 15 && ! isRaining ): weatherAdvice = " It's cold but dry. Just a jacket is fine! 🧥 " ; break ; case ( temperature >= 15 && isRaining && isNightTime ): weatherAdvice = " Warm, rainy night. Stay indoors if you can! 🌧️🌃 " ; break ; case ( temperature >= 15 && isRaining && ! isNightTime ): weather
AI 资讯
RPA vs BPA vs Intelligent Automation: A Practical Map for Ops Leaders
Most automation purchases in ops organizations go wrong at the category level, before a single vendor demo happens. A team buys RPA because "automation" was the ask, then discovers six months in that the actual problem needed process orchestration across systems, not a bot clicking through a legacy UI. Or they buy an intelligent automation platform for a workflow that was always going to be simple, straightforward API orchestration, and pay for a cognitive layer they never needed. The three categories solve genuinely different problems, and the confusion between them is expensive in a specific, avoidable way. RPA: automating the UI, not the process Robotic process automation does one thing, and it's narrower than most pitches suggest: it mimics a human interacting with a screen — clicking buttons, reading fields, typing values — usually through UI selectors or an application's accessibility tree, not through an API. That's the entire point of it: RPA exists for systems that don't expose an API at all, or where getting API access would take longer than building a bot that just uses the interface the way a person would. That mechanism is also its defining weakness. A bot built against specific UI coordinates or element selectors breaks the moment the underlying application changes — a button moves, a field gets relabeled, a vendor ships a UI update — and the failure is usually silent until someone notices the process stopped completing. This is the single most common complaint about production RPA deployments, and it's not a implementation mistake, it's structural: robotic process automation is fundamentally built on mimicking a visual interface, and visual interfaces change for reasons that have nothing to do with the automation depending on them. RPA is the right tool specifically for swivel-chair tasks — moving data between systems that don't talk to each other, with no API available on at least one side, at a volume that makes manual entry genuinely costly. It's t
AI 资讯
Building a Personal Blog with Laravel: A Real World Project
A personal blog sounds like a simple Laravel project. Create posts, show them on the homepage, and you are done. But once you start adding search, categories, tags, comments, SEO, authentication, analytics, and an admin panel, things become much more interesting. I built this Laravel Personal Blog as a real world project to explore those problems instead of building another basic CRUD application. The complete source code is available on GitHub: https://github.com/arafat-web/laravel-personal-blog Table of Contents What Is This Project? Technology Stack Main Features Project Structure How Visitor Analytics Works SEO and Content Management How to Run the Project What I Learned Final Thoughts What Is This Project? This is a complete single-author blogging platform built with Laravel. It includes both a public blog and a custom admin panel. The project was built without additional application packages, so most of the important functionality is visible in the codebase itself. The public side contains: Homepage Blog posts Categories Tags Search Comments RSS feed Sitemap SEO metadata Post view tracking The admin panel contains: Dashboard Post management Category and tag management Comment moderation User management General settings SEO settings Visitor analytics Technology Stack The project uses: PHP 8.3+ Laravel 13.17 MySQL or SQLite Blade Eloquent ORM JavaScript CSS PHPUnit The current project configuration requires PHP 8.3 and Laravel 13.17. Main Features The project goes beyond basic CRUD. For example, posts can have categories, tags, comments, authors, featured images, publishing status, and view counts. The Post model defines these relationships using Eloquent: public function user (): BelongsTo { return $this -> belongsTo ( User :: class ); } public function categories (): BelongsToMany { return $this -> belongsToMany ( Category :: class ); } public function tags (): BelongsToMany { return $this -> belongsToMany ( Tag :: class ); } public function comments (): HasMa
AI 资讯
AI Agent Standards Experiment: Test Rules Before Teams Trust Them
AI agents can look reliable after one impressive demo and still fail the moment real users, messy repositories, and conflicting instructions enter the room. The dangerous part is not that an agent makes mistakes. The dangerous part is that teams often change agent rules based on vibes, not evidence. If you are building an AI feature, internal coding agent, support assistant, research workflow, or automation layer, your standards need tests. Not just model evals. Not just unit tests. You need a way to answer a practical question: Did this new rule, skill, prompt, or tool instruction actually make the agent better? This guide shows a lightweight experiment system for AI agent standards. You can use it before rolling out new agent instructions across a product, engineering team, customer workflow, or multi-tenant AI application. No vendor pitch. No magic framework. Just a repeatable way to stop guessing. Why Agent Standards Need Experiments Most teams already have standards for human developers: code review rules security policies testing expectations deployment checklists naming conventions observability requirements AI agents need the same kind of guidance, but they behave differently from humans and traditional software. A human may read a coding standard once and remember the intent. An agent may load the wrong instruction file, ignore a rule buried deep in context, over-follow a stale example, or select no skill at all. That means the main risk is not only bad instructions. It is unreliable instruction delivery. Recent practitioner discussion around agentic development points to the same pattern: teams are moving from simple prompts toward skills, rules files, context packs, tool registries, desktop agents, and workflow harnesses. At the same time, developers are asking harder questions about governance, cost, reliability, and whether agents can be trusted with production work. What Counts as an AI Agent Standard? An AI agent standard is any reusable instruction t
AI 资讯
Claude Code Is Burning Your Token Budget. Here's the Receipt.
Claude Code Is Burning Your Token Budget. Here's the Receipt. I found $2,500/year of hidden token waste in my Claude Code setup. It was the MCP servers. The Discovery Last week I noticed my Claude Code conversations were dying at around message 15. Context window full. The model starts forgetting earlier instructions. Tool calls fail. The conversation degrades into hallucination. I assumed it was my fault — too many messages, too much context. So I started measuring. Here's what I found: Session start: Claude system prompt: ~8,000 tokens MCP schema injection: ~111,000 tokens User's first message: 50 tokens ────────────────────────────────────────── Total before any work: ~119,000 tokens Remaining context: ~81,000 tokens I was starting every conversation with 60% of my context already consumed. The culprit wasn't my prompts. It was the 10 MCP servers I had proudly configured in my claude_desktop_config.json . The Receipts I measured each server's schema injection using tiktoken: Server Why I Installed It Token Cost Times Used/Week GitHub PR reviews, issues 12,440 3 Slack Message reading 14,672 0 Google Drive Doc access 47,293 1 Notion Knowledge base 13,780 2 Postgres Query DB 8,231 4 Puppeteer Screenshots 5,890 0 Filesystem File access 3,847 15 Brave Search Web search 2,103 5 Memory Context persistence 2,567 0 Sequential Thinking Reasoning 890 2 Total 111,713 Look at the "Times Used/Week" column. Three servers were used zero times. Two more were used once or twice. But every single one of them was injecting 100% of its schema into every conversation. I was paying $0.33 per conversation — $2,500/year — to load schemas for tools I barely used. The Moment I Realized Everyone Has This Problem I posted my findings on Bluesky. Within hours: "I had the same issue. Removed 6 MCP servers and my conversations went from dying at message 15 to lasting 40+ messages." — @developer1 "GitHub MCP is 12K tokens but Claude Code already has gh CLI built in. Why did I install it?" — @dev
开发者
Dev log #18 From Redis Brokers to Knowledge Graphs: A 177-Commit Sprint
Hit a perfect 7-day streak this week, shipping 177 commits across systems architecture and personal...
AI 资讯
Product Engineering Alignment
A feature takes three days to code and three weeks to deliver. The difference is not always engineering capacity. A developer starts implementation and discovers that an eligibility rule is undefined. Product needs an answer from operations. A missing UX state appears next. Then engineering finds that the requested behavior conflicts with the current data model, which forces a scope decision. The code may still take three days. The delivery system takes three weeks. This is where product engineering alignment becomes an engineering leadership problem. The visible work happens in code, but much of the elapsed time happens between decisions: waiting for clarification, resolving constraints, revisiting scope, and discovering assumptions that should have surfaced earlier. The common response is to improve requirements, add meetings, or demand better estimates. Those actions may help, but they do not address the core issue. Product-engineering alignment is primarily a decision-flow problem . The useful question is not: Are product and engineering communicating enough? It is: Where does work stop because the person holding it cannot make the next decision? That question is more useful because it exposes where delivery actually slows down. Why Product and Engineering Become a Delivery Bottleneck Product and engineering approach the same feature with different knowledge. Product typically understands the customer problem, business priorities, stakeholder expectations, commercial constraints, and desired outcome. Engineering typically understands architecture, dependencies, operational risk, implementation alternatives, and the cost of changing the system. Neither side has the full picture, that is normal. The problem begins when the process assumes one side can finish its thinking before the other begins. Consider a requirement that appears simple: Allow customers to cancel an order. Engineering cannot implement that correctly without answering several questions: Until what
AI 资讯
We Benchmarked Our Agent Against opencode: Same Task, Same Model, 40 Percent Fewer Credits
Every coding agent says it is efficient. Almost none of them publish the bill. So we ran the boring experiment: the same bugfix, the same model, the same API, the same prices, and a byte identical prompt, once through opencode and once through the coding agent inside Locally Uncensored. Headline: opencode averaged 2157 credits over three runs. Our 2.6.6 agent finished the identical task for 1298 . That is about 40 percent less, and even the cheapest opencode run came in 29 percent above our number. The interesting part is not the headline. It is why the gap exists, and it is not the reason most people guess. Setup A cost comparison is only worth reading if everything that drives cost is nailed down. What was held constant: Held constant Value Task Fix a failing test in a small npm repo, then commit Repository Three files, a one line bug in add.js , tests red at the start Prompt Byte identical, sha256 29cec6c3...cf62687 Model deepseek-ai/DeepSeek-V3.2 Endpoint The same OpenAI compatible API for both agents Prices Same account, same tier, same per token rate Counting One wire proxy in front of the API, credits read before and after every run opencode 1.18.21 from npm, wired as an OpenAI compatible provider, opencode run --auto , otherwise defaults Success was defined before the runs, not after: npm test passes exactly one commit, with the required message only add.js changed clean working tree at the end All four runs cleared that bar. Nothing failed, so cost is the only variable that moved. The numbers Run Credits Requests Prompt tokens Success opencode, run 1 1679 8 98,789 yes opencode, run 2 2433 11 146,058 yes opencode, run 3 2358 11 146,387 yes Locally Uncensored 2.6.6 1298 16 74,629 yes Locally Uncensored 2.6.5 4395 30 257,270 yes Read the last row first. Our own shipped agent from one release earlier is the most expensive thing in that table, by a lot. This is not a chart built so that we win by construction. It is a chart that shows what one efficiency pass is
AI 资讯
Stop Blaming the LLM: Why Your AI Agents Keep Failing (And How to Fix Them)
I was staring at a broken Next.js and Express backend integration late at night, convinced my AI agent had lost its mind. It was supposed to be a straightforward n8n automation pipeline. Yet, every time it ran, it hallucinated non-existent packages and dumped its context halfway through. My System 1 intuitive reaction flared up immediately: The LLM just isn't smart enough. I sat there, exhausted, ready to rewrite the prompt for the twentieth time. Engaging System 2 Taking a step back, I forced myself to engage my analytical System 2 brain. I wasn't dealing with a lack of model intelligence; I was dealing with a lack of infrastructure. I was running a massive, powerful AI model with zero guardrails. No persistent memory. No verification. Just dumping a giant Mongoose schema into a prompt and hoping for the best. I was essentially dropping a Formula 1 engine onto a wooden skateboard and wondering why it crashed at the first turn. What is Harness Engineering? I stopped obsessing over prompt engineering and started focusing on Harness Engineering. The model is just the engine; the harness provides the chassis, the steering, and the brakes. Here is how I completely restructured my agentic workflow: Context Management: Instead of flooding the context window with raw codebase dumps, I implemented targeted retrieval. The agent now only sees the specific files required for the immediate task. Standardized Tools: I integrated Model Context Protocol (MCP) servers, giving the model bounded, secure ways to execute actions rather than just generating text. Durable State: If a long-running workflow pauses or fails, the system now checkpoints its progress. It resumes exactly where it left off instead of starting from scratch. Strict Verification: "Looks good to me" is no longer an acceptable output. The agent is forced to run tests and verify the CLI output before concluding a task. Learn to Break the System The results were immediate. The hallucinations stopped, and the agent shif
AI 资讯
Planning Feature Integrations Before Development: A Practical Approach
When working on a web project, one of the easiest ways to create unnecessary development work is to start coding before the feature requirements and integration approach are clear. I’ve found that creating an issue, proposal, or short technical plan before development can make a big difference. It gives everyone an opportunity to discuss the idea, identify potential problems, and agree on an implementation approach before code changes begin. This is particularly useful for projects that evolve over time. New features can affect existing components, user flows, APIs, databases, and the overall interface. Thinking about these dependencies early can reduce redesigns and duplicated work. For example, while working on projects such as Simulator Drag Race , planning new simulation features before implementation helps keep the existing functionality organized while making room for future improvements. A simple pre-development process can be: Describe the feature and the problem it solves. Create an issue or proposal for discussion. Identify which existing components will be affected. Discuss possible implementation approaches. Agree on the approach before development starts. Break the approved approach into smaller development tasks. This process doesn't need to be complicated. Even a short issue with clear requirements and a few implementation notes can prevent misunderstandings later. Another benefit is that early communication gives maintainers and contributors visibility into upcoming changes. Someone may already be working on a related feature, or a maintainer may know about an architectural limitation that isn't immediately obvious. For open-source and collaborative projects, I think this approach is especially valuable. Good communication before development can be just as important as the code itself. How does your team handle feature proposals before development? Do you prefer detailed technical proposals, simple GitHub issues, or discussing the implementation dire
AI 资讯
Why AI Output Feels Wrong Even When It Is Correct
AI can produce an answer in seconds. The answer may be clear, plausible, and even correct. Yet something about it can still feel wrong. I do not think this discomfort comes only from hallucinations or poor model accuracy. Sometimes the real problem is simpler: The AI returned an output, but it did not return the work in a form that another person can safely continue. This is not a new problem created by AI. It is the same problem we already have when delegating work to another person. What do we expect when we delegate work? Imagine a manager asking a team member: Please prepare a proposal for reducing next month's operating costs. The team member reviews several documents, compares multiple options, and replies: We should choose Option A. The requested conclusion has been delivered. But has the work really been handed back? The manager still does not know: What objective the team member optimized for Which documents and facts were examined Which assumptions and constraints were used Which alternatives were compared Why Option A was preferred Which conditions remain unverified What must be reconsidered if the situation changes The original request may not have explicitly demanded all of this. Even so, we normally expect a competent team member to understand the purpose of the assignment and to return enough information for someone else to review, approve, revise, and continue the work. That information is not additional reporting attached to the work. It is part of the handoff condition that makes delegation possible. AI often returns the conclusion without the handoff Now replace the team member with an AI assistant. The AI immediately recommends Option A and produces a polished explanation. Because the answer arrives so quickly and looks complete, it is easy to confuse the existence of an output with the completion of the work. But the same questions remain: How did the AI interpret the objective? What was considered in scope and out of scope? Which sources were a
AI 资讯
The Exact Funnel I Use to Get Free CLI Tools Their First Users
Every open-source tool has the same brutal first 90 days: zero users, zero signal, no idea whether anything works. I have shipped several free CLI tools and browser tool sets. This is the exact funnel I use — no ads, no paid growth, no "build in public" theater. Just a repeating sequence of small, concrete actions. Step 1: Make the Tool Trivial to Try The first rule: npx must work. If a reader has to install, configure, and read a README before running the first command, the funnel is already broken. npx @wuchunjie/dotguard . That is the entire onboarding. Zero dependencies, no config, instant output. The first 10 seconds decide whether the reader comes back. Step 2: Publish One Article Per Angle Not one article. One per angle , spread over time: Tutorial — "Scan your .env files in 1 command" (the how) Comparison — "Why I stopped using X" (the why) Listicle — "5 tools for Y" (the discovery) Workflow — "My dev setup" (the context) Security/devops — "Your CI is missing this" (the fear) Each article targets a different search intent. A developer looking for "pre-commit secret scan" lands on article 4, not article 1. The funnel is wide because the angles are wide. Step 3: Cross-Link Everything Every article mentions every tool. The footer of a snippet article lists the scaffolder and the scanner. The GitHub repo links to the articles. The npm README links to the articles. The effect is compounding: a reader of article 3 meets four tools, not one. Your content becomes a network instead of a pile. Step 4: Make the GitHub Repo the Hub The repo README is the landing page that never goes stale: One-line description per tool Install/run commands (copy-paste ready) Links to every article A donation link, present but quiet GitHub is where developers actually trust. Stars and forks are the signal that converts "interesting article" into "let me try it". Step 5: Add the Quiet CTA One line at the end of every article: If this saved you time, a Ko-fi keeps the next tool coming. No
AI 资讯
I Built Browser-Local File Tools So Files Don't Need to Be Uploaded
A lot of small file jobs still follow the same awkward pattern: choose a file, upload it to someone else's server, wait for processing, download the result. For some tasks, that server round trip is unnecessary. I have been building FileNest Worktools , a browser-based toolkit for repetitive file work, around a simple constraint: If a task can reasonably be done inside the browser, the file contents should stay on the user's device. What currently runs locally The current FileNest tools cover: batch file renaming sequential, reverse, and custom-order renaming JPG / PNG / WebP conversion image resizing and compression image-to-text OCR with editable review PDF merge, split, extract, and images-to-PDF text export to DOCX, PDF, TXT, Markdown, and HTML CSV / TSV / JSON conversion duplicate-file detection For these current browser-local workflows, the file contents are processed on the device rather than being sent to a conversion server. Why local processing matters Privacy is one reason, but it is not the only one. Many file operations do not actually need server-side infrastructure. Renaming a file is mostly about filenames, order, extensions, and conflict checks. Image resizing can be handled with browser APIs. CSV and JSON conversion is essentially local parsing and serialization. Duplicate detection can compare file fingerprints locally. If those jobs can stay inside the browser, there is less network overhead and one less copy of the user's files being created somewhere else. I also wanted the risky parts to stay visible One thing I dislike about many online file tools is the "click and hope" workflow. So I tried to make FileNest show more information before or after processing: renamed files can be previewed before packaging original files are not silently overwritten image compression reports actual output bytes duplicate detection uses content matching rather than filename guesses OCR output can be reviewed and edited the image enhancer does not claim that shar
AI 资讯
FieldOS, Part 1: I Built the Core System and Timed Every Single Hour
A while back, I built a complete field service management platform for the first time. It worked. But building it taught me as much about what I'd do differently as it taught me about field service software itself. So I built it again — FieldOS — the way I'd build it now, with everything I picked up the first time around. And this time I tracked every real hour it took, start to finish. Not to hit a deadline. To finally answer a question I'd always guessed at before: how much time does a project like this actually take, and what is that time genuinely worth to the business paying for it? I do maintenance for a car dealership, an auto parts warehouse, a body shop, and five parts stores in my day job, so I've seen firsthand what off-the-shelf field service software costs a business — and how much of it a smaller crew never touches. FieldOS is built so a business only pays for the pieces it actually needs. But the real question underneath this series isn't what to charge. It's how to price custom work in a way that's honest about what the work is worth, without pricing a small business out of getting it built at all. This series is that experiment, told through the build itself. How the Core System Works Every field service business needs the same five things to run day to day, no matter what they fix or deliver. This is the part of FieldOS nobody gets to skip — the foundation every add-on plugs into later in this series. A Front Door for Every Job: A request comes in, gets logged, and moves through a status list a business defines for itself — not a fixed workflow some software vendor decided everyone needs. A body shop's process doesn't look like an HVAC crew's, so the system shouldn't force them into the same one. Real Parts Tracking: Every part or supply used on a job gets logged against real stock at a real location, and the system flags it automatically the moment something drops below what a crew needs on hand — not after a technician shows up to an empty shelf.
AI 资讯
Leveling up OpenCode... and not in the way you would expect.
So I've been using OpenCode for a while now, and it's pretty cool. It's clean, minimal, effective, and not hacking other companies with rogue AI bots 😅. But there is one thing that I dislike about all of these AI tools besides people using them wrong: it's all 1 prompt, 1 agent at a time. Even with these new crazy models such as Kimi K3, Claude Fable 5, GPT Sol, DeepSeek V4 Pro, and the list goes on, having reliable workflows/pipelines is the best way to use AI effectively. Even these models that seem to be the "best" have pretty major flaws. Whether it is hardly speaking in an understandable way or just lying to your face, AI can be pretty annoying. I mean, they literally have "peak hours" and then "dumb hours" depending on the time zone. All of these are reasons why I just built an open-sourced project to fix this. A little while ago, I discovered node-based workflows. Like I said earlier, using one agent one prompt at a time felt super unproductive, so I was inspired to fork OpenCode's harness and create my own twist on it. It still follows the concept of BYOK keys and using any provider you want, but instead of simply prompting, you build a workflow that you can easily save to reuse over and over again. How it works is you create a card for an agent, specify their role (planner, architect, coder, etc), and connect them to another agent or a chain of agents. Now it's not just Opus 5 doing everything, but every agent having a designated role and working together. You can make it as simple or complex as you want, and fork it so that it fits your needs. That's all I have to say. I am still working on it and constantly improving it. Feel free to fork it and make it your own as well, and I hope that this tool levels up how you use AI. Link: https://github.com/SeeRay11/OpenFlow
开发者
Anyone ever go back to their notetaker outputs and summaries?
开发者
Antes de escrever uma linha de código, tive que provar que aguentava trocar de SO
Conteúdo 1. Apresentação - Omarchy 2. Praticidade 3. Agentes de IA 4. Desuso do Mouse 5....
AI 资讯
Extending the Login Session to 1 Year for Kiosk‑Mode TV Screens (Next.js API Route)
Extending the Login Session to 1 Year for Kiosk‑Mode TV Screens (Next.js API Route) TL;DR: I changed the maxAge of the auth cookie from 30 days to 365 days in src/app/api/login/route.ts . The tweak lets a TV kiosk stay logged in without a daily refresh, while keeping the same security flags. The Problem Our kiosk‑mode deployment runs on large‑format TVs that display a live dashboard. The UI is protected by the same JWT‑based authentication we use for the web app. After a user logs in, the server sets a Set-Cookie header with the token: cookie : serialize ( " token " , jwt , { httpOnly : true , secure : true , sameSite : " lax " , path : " / " , maxAge : 60 * 60 * 24 * 30 , // 30 days }); In practice, the TVs are turned on once a week and are expected to stay signed in for months. After 30 days the cookie expires, the dashboard silently redirects to the login page, and a technician has to manually re‑authenticate the device. The symptom was a 401 Unauthorized error after exactly 30 days, logged as: Error: No valid session cookie found (maxAge expired) The root cause: the maxAge value was hard‑coded to 30 days, which is fine for browsers but not for unattended kiosks. What I Tried First My initial thought was to keep the 30‑day limit and simply refresh the token on every API call . I added a middleware that called the login endpoint silently if a request lacked a valid token. The flow looked like this: // pseudo‑middleware if ( ! req . cookies . token ) { await fetch ( " /api/login " , { method : " POST " , body : storedCredentials }); } What went wrong? Rate limiting – The middleware hit the login endpoint on every request that missed a token, quickly exhausting the auth provider's rate limit. State leakage – Storing credentials on the client (even in a server‑side environment) introduced a security surface. Complexity – The extra round‑trip added latency and made the code harder to debug. After a few failed attempts (and a stack trace full of 429 Too Many Requests )
AI 资讯
Toxic Work Culture: Shifting from Competition to Collaboration Boosts Collective Productivity in Large Organizations
Technical Reconstruction of Toxic Work Culture Mechanisms Mechanisms and Their Impact Chains The evolution of workplace dynamics in large organizations has been marked by a pronounced shift from collaborative ecosystems to competitive arenas. This transformation is driven by specific mechanisms that, while often implemented with the intent to enhance productivity, inadvertently foster toxicity. Below, we dissect these mechanisms, their internal processes, and the observable effects they precipitate, elucidating the causal pathways that undermine organizational health. Performance Evaluation Systems Impact : Stackranking, hidden metrics, and PR/LoC counts incentivize individual competition, distorting the focus from collective goals to personal advancement. Internal Process : Employees, driven by survival instincts, prioritize outperforming peers over collaborative problem-solving, eroding the foundation of trust. Observable Effect : The erosion of trust and reduced team synergy directly correlate with diminished project outcomes and increased interpersonal conflicts. PIP Processes Impact : When PIP (Performance Improvement Plan) systems are weaponized punitively rather than utilized developmentally, they become tools of fear rather than growth. Internal Process : Employees perceive PIPs as existential threats, triggering stress responses that manifest as defensiveness and reduced engagement. Observable Effect : The resultant demoralization accelerates turnover rates, exacerbating recruitment costs and depleting institutional knowledge. Time Tracking Systems Impact : An overemphasis on quantifiable hours worked relegates quality and innovation to secondary priorities, fostering a culture of compliance over excellence. Internal Process : Employees, incentivized by logged hours, allocate effort disproportionately to tasks that maximize visibility rather than impact. Observable Effect : Despite inflated time logs, overall productivity declines as creative and strategic